manan-kanchu — AI Code Detector

Detect AI-generated code, scan vulnerabilities, audit security policies, and protect your codebase — all inside VS Code.

What is manan-kanchu?

manan-kanchu (mah-nan-KAHN-chu) is a Quechua word meaning "there isn't" — representing the goal of detecting what doesn't belong: AI-generated code masquerading as human work.

It provides a comprehensive security and code-quality dashboard directly inside VS Code, combining heuristic analysis with multi-provider AI intelligence to give you a full picture of your codebase health.

100% open source · MIT license · Privacy-first — your code goes directly to your chosen AI provider. No manan-kanchu servers.

Features

1. AI Code Detection

Hybrid scoring combines heuristic analysis (40%) and AI semantic analysis (60%) to produce a 0–100% confidence score per file. Indicators include:

• Naming convention uniformity, comment density, boilerplate ratios
• Structural patterns common in LLM-generated code
• Semantic fluency scoring via the active AI provider

2. Vulnerability Scanner

20+ OWASP-aligned patterns with CWE codes:

3. Malicious Code Scanner

Detects code designed to harm or exfiltrate — useful for auditing third-party code and supply-chain risks:

• Keyloggers — keydown/keypress event listeners with suspicious data handling
• Data exfiltration — cookie/localStorage theft, beacon calls, form hijacking
• Crypto miners — WebAssembly or script patterns typical of browser miners
• Obfuscation — base64 decode chains, eval(atob(...)), Function() constructor abuse
• Clipboard hijack — silent clipboard content replacement

4. Policy Evaluator

10 built-in compliance rules evaluated across your project:

Custom rules can be added via the manan-kanchu.policies setting.

5. Shell Command Analyzer

Paste any shell command and get an instant risk assessment:

• Destructive commands (rm -rf, truncate, dd)
• Remote execution (curl | bash, wget | sh, eval $(...))
• Privilege escalation (sudo bash, chmod 777, setuid)
• Safe alternative suggestions for flagged commands

6. Audit Dashboard

Dark-theme WebviewPanel with 6 tabs:

Export full audit reports as Markdown to .manan-kanchu/report-<timestamp>.md.

Quick Start

Step 1 — Install

Search "manan-kanchu" in the Extensions panel (Ctrl+Shift+X), or run:

code --install-extension sergioide007.manan-kanchu-code-ai

Step 2 — Configure an AI Provider

Press Ctrl+Shift+M → Configure AI Provider:

Local (free, fully private):

# Ollama — auto-detected at http://localhost:11434
ollama pull codellama

# LM Studio — auto-detected at http://localhost:1234
# Load any GGUF model and start the local server

Cloud:

Select Anthropic, OpenAI, or Google Gemini → enter your API key. Keys are stored in the OS keychain via VS Code SecretStorage — never in plaintext, never in settings.json.

Step 3 — Open the Dashboard

Ctrl+Alt+M   →  Open manan-kanchu Dashboard
Ctrl+Shift+M →  Quick command menu

Step 4 — Scan Your Project

Click Scan Project in the dashboard sidebar or use:

• Ctrl+Alt+S → Scan current file
• Right-click any file → manan-kanchu: Scan Current File
• Select code → right-click → manan-kanchu: Scan Selected Code

Commands & Shortcuts

Ctrl+Shift+M shows the command menu without conflicting with other extensions.

AI Providers

Auto mode (default) — tries Ollama → LM Studio → Anthropic → OpenAI → Gemini. First available wins. Local providers are always preferred for privacy.

Recommended Models

Settings Reference

All settings are configurable in VS Code Settings UI or settings.json.

Architecture

src/
├── extension.ts            ← Activation, command registration
├── core/
│   ├── interfaces.ts       ← All shared TypeScript types
│   ├── config.ts           ← Settings manager
│   └── SecretManager.ts    ← OS keychain via VS Code SecretStorage
├── providers/
│   ├── AIProviderManager.ts  ← Auto-selection, provider lifecycle
│   ├── AnthropicProvider.ts
│   ├── OpenAIProvider.ts
│   ├── GeminiProvider.ts
│   ├── OllamaProvider.ts
│   └── LMStudioProvider.ts
├── analyzers/
│   ├── AICodeDetector.ts     ← Hybrid heuristic + AI scoring
│   ├── VulnerabilityScanner.ts ← 20+ OWASP patterns
│   ├── MaliciousCodeScanner.ts ← 7 malicious code categories
│   ├── PolicyEvaluator.ts    ← 10 built-in + custom rules
│   ├── ShellAnalyzer.ts      ← Shell command risk assessment
│   └── utils.ts
├── panel/
│   └── MainPanel.ts          ← WebviewPanel SPA (dashboard)
├── skills/
│   ├── SkillRegistry.ts
│   ├── ScanFileSkill.ts
│   ├── ScanProjectSkill.ts
│   ├── GenerateReportSkill.ts
│   └── SanitizeCodeSkill.ts
└── mcp/
    ├── MCPManager.ts
    └── FilesystemMCP.ts

Adding GIF Demos

To add demo GIFs to this README once you have recorded them:

1. Place GIF files in the media/ folder (keep each under 3 MB)
2. Uncomment the corresponding ![...] lines above each feature section

Recording tips: Use ScreenToGif (Windows) or Kap (macOS). Use VS Code with GitHub Dark theme so the UI blends naturally. Crop to the VS Code window only.

Privacy

• No telemetry by default (manan-kanchu.privacy.telemetry: false)
• API keys stored in the OS keychain, never in settings files
• Code sent only to your chosen provider — no manan-kanchu servers
• Local providers (Ollama, LM Studio) keep everything 100% on-device
• See PRIVACY.md for full details

Contributing

git clone https://github.com/sergioide007/manan-kanchu-code-ai
cd manan-kanchu-code-ai
npm install
npm run compile   # or: npx tsc --watch
npm test          # 41 unit tests across 6 suites

Press F5 in VS Code to launch the Extension Development Host.

License

MIT — see LICENSE.